Catus Locatus

(2025-10-30) Major Update: Deploying to Kubernetes

Legacy Version (PRE-DEVOPS BOOTCAMP)

Demo

Overview

My Role

Approach

Containerization

Kubernetes

ali@Ali:~/catus-locatus-k8s/k8s$ tree .
.
├── backend
├── frontend
├── monitoring
└── networking

Terraform

CI/CD

Teamwork and Project Management

System Design

Azure

AWS

resource "aws_iam_policy" "external_dns" {
  name        = "external-dns-policy"
  description = "Allow external-dns on K8s to manage Route 53 records"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "route53:ChangeResourceRecordSets"
        ]
        Resource = "arn:aws:route53:::hostedzone/${var.aws_r53_zone_id}"
      },
      {
        Effect = "Allow"
        Action = [
          "route53:ListHostedZones",
          "route53:ListResourceRecordSets",
          "route53:GetChange"
        ]
        Resource = "*"
      }
    ]
  })
}

Kubernetes

The Full System Architecture

Observability and Monitoring

Security Measures

FROM node:25.0.0-alpine AS build
WORKDIR /app

COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM nginx:1.29.2-alpine
WORKDIR /usr/share/nginx/html

COPY --from=build /app/dist ./
COPY nginx.conf /etc/nginx/nginx.conf

RUN addgroup -g 1001 -S team4 && \
    adduser -S team4 -u 1001

RUN chown -R team4:team4 /usr/share/nginx/html && \
    chown -R team4:team4 /var/cache/nginx && \
    chown -R team4:team4 /var/log/nginx && \
    chown -R team4:team4 /run

USER team4

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=5 \
  CMD curl -f http://localhost:8080/health || exit 1

CMD ["nginx", "-g", "daemon off;"]

Outcomes

• TLS/SSL Termination with Ease: Using external-dns and cert-manager, we achieved an automated process with TLS certificate issuance. It was my first time implementing the two, so it was a bit of a challenge, but now I know what to do for my next project :D
• Rolling updates: Both of our two deployments run rolling updates strategy, ensuring there's NO DOWNTIME on new version deployments!
• Fully automated infrastructure: Thanks to Terraform, we could delete and recreate this entire infrastructure in MINUTES! All the resources in the system diagrams above are created via Terraform and Github Actions Workflows.
• Spatial Queries: This is more of a fullstack development feature rather than a DevOps one, but in the backend, since we're using a Map-focused app, I utilized spatial queries with PostgreSQL's POSTGIS extension! It did WONDERS for query times!

Challenges

• Setting up external-dns with cert-manager was easy in hindsight, but it was a tough task. But nothing a bit of Googling and YouTubing can't fix! :) Glad I got it done.
• We had an Azure-Subscription-Wide problem where AKS clusters would be so unreliable to provision, getting a 400 Bad Request error with NO MESSAGE describing the error itself. We had to try various region-SKU combinations to just get it to provision. Definitely slowed us down. I solved this TEMPORARILY by setting the lifecycle of the AKS resource on Terraform prevent_destroy = true
• Another challenge was the Access Policy issue of being deleted from the Key Vault. Every few hours the Key Vault's access policies would be wiped out for some reason. Still no fix, but I created a Bash script that just recreated them using Azure CLI instead of manually doing it every time.

What Could Improve

• Using RBAC instead of Access Policies for Key Vault.
• We have a Github Action that pushes new backend/frontend images on PR if any of the source code for them changes. Right now it pushes to the tag latest which is bad, I should've changed it to something like testing or dev, then have it deploy alongside the production deployment.
• Restrict access to ACR: Maybe using RBAC or private endpoints? But Private Endpoint may not be ideal if using Github.

Conclusions